Database
WordPress Vulnerability Database (page 186)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'
Exclusive Addons for Elementor
≤2.7.9.8Update to 2.7.9.9
- Medium4.3Authenticated (Custom role+) Insecure Direct Object Reference
Fluent Support – Helpdesk & Customer Support Ticket System
<2.3.1Update to 2.3.1
- Medium5.3Unauthenticated Information Exposure
Mapster WP Maps
<1.24.0Update to 1.24.0
- Medium5.3Unauthenticated Information Exposure
JetSearch
≤3.6.1.2Update to 3.6.1.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
<3.1.4Update to 3.1.4
- Medium4.3Missing Authorization
Booking for Appointments and Events Calendar – Amelia
<2.4.4Update to 2.4.4
- Medium4.3Missing Authorization
ShopLentor Pro
≤2.8.5Update to 2.8.6
- Medium5.3Missing Authorization
ShopLentor Pro
≤2.8.5Update to 2.8.6
- High8.8Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
Pronamic Pay
≤10.1.0Update to 10.2.0
- Critical9.8Unauthenticated Privilege Escalation via Unverified Password Change
Single Sign On For TNG
≤2.0.0Update to 2.1.0
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
CubeWP Framework
≤1.1.30Update to 1.1.31
- Medium6.1Reflected Cross-Site Scripting via 'id' Parameter
Responsive Thumbnail Slider
<1.1.53Update to 1.1.53
- Medium5.3Unauthenticated Sensitive Information Disclosure
WooCommerce PayPal Payments
≤3.3.2Update to 3.4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Powerkit – Supercharge your WordPress Site
≤3.1.0Update to 3.1.1
- Medium6.1Reflected Cross-Site Scripting via 'param'
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤6.2.8Update to 6.2.9
- Medium4.9Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
WPvivid — Backup, Migration & Staging
≤0.9.131Update to 0.9.132
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action
RealHomes Memberships
≤3.0.9Update to 3.1.0
- Medium4.9Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
Kirki – Freeform Page Builder, Website Builder & Customizer
≤6.0.13Update to 6.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Powerkit – Supercharge your WordPress Site
≤3.1.0Update to 3.1.1
- Medium5.3Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
PixelYourSite Pro – Your smart PIXEL (TAG) Manager
<12.6.1Update to 12.6.1
- Medium6.6Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
Payment forms, Buy now buttons, and Invoicing System | GetPaid
≤2.8.56Update to 2.8.57
- High8.1Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
NEX-Forms – Ultimate Forms Plugin for WordPress
≤9.2.3Update to 9.2.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Form Field Values
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
≤4.3.3Update to 4.3.4
- High8.1Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.4.20Update to 2.4.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.8.1Update to 3.7.8.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
≤3.7.8Update to 3.7.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter
Advanced Woo Labels – Product Labels & Badges for WooCommerce
≤2.48Update to 2.49
- Medium4.9Authenticated (Administrator+) SQL Injection via 'fields' Parameter
Icegram Mailer – Reliable Email Deliverability, No-Code SMTP Replacement & Email Logs for WordPress
≤1.0.12Update to 1.0.13
- Medium6.5Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
≤3.1.42Update to 3.1.43
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
≤1.9.0Update to 2.0.0